INFD-WP-0010-T02: record the founder-run present-existing release (2026-11-01)

The founder ran the release:
- access-engine compact-sitting v14 (Helm revision 14) first, then Argo
  005709a: image ca75f0be, runtime ConfigMap b488b96a0953
- backup ed4469e7, held off-cluster
- health and readiness 200; private routes 404 on the public origin
- store counts unchanged, and an existing memo loaded under v14
- executor-identity probe 503 approval_unreadable; sso/default probe 403
  submitter_unknown

T02 stays open until the executor's present-existing memo is accepted at aal2 and
consumed (NK-WP-0056 pilot).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md

@@ -120,6 +120,18 @@ waits for the digest from CI.
 
 It is pinned in `admission.candidate.json` and `service.candidate.json`. The runtime ConfigMap is unchanged
 (`…b488b96a0953`). The pin commit is RELEASE_SHA. The release itself is founder-run.
+**Released 2026-11-01 (founder-run).**
+- access-engine compact-sitting v14 (Helm revision 14) went first, then Argo `005709a`: image `ca75f0be…`,
+  ConfigMap `…b488b96a0953`.
+- The backup is sha256 `ed4469e7…`, held off-cluster.
+- healthz and readyz return 200, and the private routes return 404 on the public origin.
+- The counts are unchanged (20/70/0, 472, 48), and an existing memo loaded for the founder under v14.
+- The executor-identity probe returned 503 `approval_unreadable` (random id); the `sso/default` probe returned 403
+  `submitter_unknown`.
+- The executor's egress to 8081 is live.
+
+Evidence: `docs/evidence/2026-11-01-present-existing-release/release.json`. **Still open, per done-when:** the
+founder's aal2 accept of an executor-created approval and the executor's consume (NK-WP-0056 pilot). T02 stays `wait`.
 
 Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for
 `bounded-execution`, require a packet item whose digest equals `target.admission_digest`, once the admission